what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

invision131sql.txt

invision131sql.txt
Posted Apr 18, 2005
Authored by Diabolic Crab | Site hackerscenter.com

Invision board versions 1.3.1 and below are susceptible to SQL injection attacks. Patch included.

tags | exploit, sql injection
SHA-256 | c69852c683621b1597fc45775faed3acad28f902b519c805a9e5ee5677696b8e
Download | Favorite | View

invision131sql.txt

Change Mirror Download
This is a multi-part message in MIME format.

------=_NextPart_000_0005_01C53EE6.43632B60
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

=20
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dcrab 's Security Advisory (http://www.digitalparadox.org/services.ah)
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Severity: Medium
Title: Invision board 1.3.1 and below are vulnerable to a sql injection =
vulnerability [PATCH INCLUDED]
Date: 09/04/2005

Vendor: Invision Invision Power Services
Vendor Website: http://www.invisionboard.com/
Summary: Invision board  1.3.1 and lower are vulnerable to a sql =
injection vulnerability which is caused by the non validation of input=20
in the $this->first variable


*************************************************************************=
*********************************
Get Dcrab's Services to audit your Web servers, scripts, networks, etc. =
Learn more at http://www.digitalparadox.org/services.ah
*************************************************************************=
*********************************

Proof of Concept Exploit:=20

http://localhost/forums/index.php?act=3DMembers&max_results=3D30&filter=3D=
1&sort_order=3Dasc&sort_key=3Dname&st=3DSQL_INJECTION

**************
Patch info
**************
A patched version of the vulnerable file can be found at, =
http://www.digitalparadox.org/memberlist.txt=20
Just replace /uploads/sources/memberlist.php with this, and it will be =
fixed.

A simple patch can be,

In /uploads/sources/memberlist.php on Line 274 add this code=20
                                   [CODE BEGINS]

                          if (!is_numeric($this->first)) {
                          $this->first =3D "0";
                          }

                                      [CODE ENDS]

So it should finally look like,
                                   [CODE BEGINS]

                $this->output .=3D $this->html->Page_header( array( =
'SHOW_PAGES' =3D> $links) );

                //-----------------------------
                // START THE LISTING
                //-----------------------------
                          if (!is_numeric($this->first)) {
                          $this->first =3D "0";
                          }

                $DB->query("SELECT m.name, m.id, m.posts, m.joined, =
m.mgroup, m.email,m.title, m.hide_email, m.location, m.aim_name,=20
m.icq_number,
                                   me.photo_location, me.photo_type, =
me.photo_dimensions

                                      [CODE ENDS]


Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author:=20
These vulnerabilties have been found and released by Diabolic Crab, =
Email: dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel=20
free to contact me regarding these vulnerabilities. You can find me at, =
http://www.hackerscenter.com or http://digitalparadox.org/.=20
Lookout for my soon to come out book on Secure coding with php.


-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1 - not licensed for commercial use: www.pgp.com

iQA/AwUBQlqrUSZV5e8av/DUEQJMtQCfZWYAAYfGX5zfmCWHxMGZffi87tUAnRGj
hAJ8nVzhK+VIlL4iPxDJRh02
=3Dn3TC
-----END PGP SIGNATURE-----

Diabolic Crab
Web Security,  Research & Development
dP Security
email: dcrab@digitalparadox.org
website:www.digitalparadox.org=20

This message is confidential. It may also contain information that is=20
privileged or otherwise legally exempt from disclosure.=20
If you have received it by mistake please let us know by e-mail=20
immediately and delete it from your system; should also not copy=20
the message nor disclose its contents to anyone. Many thanks.


------=_NextPart_000_0005_01C53EE6.43632B60
Content-Type: text/html;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.2604" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2><!--StartFragment --><FONT =
face=3D"Times New Roman"=20
size=3D3>&nbsp;</FONT><PRE>-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dcrab 's Security Advisory (http://www.digitalparadox.org/services.ah)
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Severity: Medium
Title: Invision board 1.3.1 and below are vulnerable to a sql injection =
vulnerability [PATCH INCLUDED]
Date: 09/04/2005

Vendor: Invision Invision Power Services
Vendor Website: http://www.invisionboard.com/
Summary: Invision board  1.3.1 and lower are vulnerable to a sql =
injection vulnerability which is caused by the non validation of input=20
in the $this->first variable


*************************************************************************=
*********************************
Get Dcrab's Services to audit your Web servers, scripts, networks, etc. =
Learn more at http://www.digitalparadox.org/services.ah
*************************************************************************=
*********************************

Proof of Concept Exploit:=20

http://localhost/forums/index.php?act=3DMembers&max_results=3D30&=
filter=3D1&sort_order=3Dasc&sort_key=3Dname&st=3DSQL_INJECTIO=
N

**************
Patch info
**************
A patched version of the vulnerable file can be found at, =
http://www.digitalparadox.org/memberlist.txt=20
Just replace /uploads/sources/memberlist.php with this, and it will be =
fixed.

A simple patch can be,

In /uploads/sources/memberlist.php on Line 274 add this code=20
                                   [CODE BEGINS]

                          if (!is_numeric($this->first)) {
                          $this->first =3D "0";
                          }

                                      [CODE ENDS]

So it should finally look like,
                                   [CODE BEGINS]

                $this->output .=3D $this->html->Page_header( =
array( 'SHOW_PAGES' =3D> $links) );

                //-----------------------------
                // START THE LISTING
                //-----------------------------
                          if (!is_numeric($this->first)) {
                          $this->first =3D "0";
                          }

                $DB->query("SELECT m.name, m.id, m.posts, m.joined, =
m.mgroup, m.email,m.title, m.hide_email, m.location, m.aim_name,=20
m.icq_number,
                                   me.photo_location, me.photo_type, =
me.photo_dimensions

                                      [CODE ENDS]


Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author:=20
These vulnerabilties have been found and released by Diabolic Crab, =
Email: dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel=20
free to contact me regarding these vulnerabilities. You can find me at, =
http://www.hackerscenter.com or http://digitalparadox.org/.=20
Lookout for my soon to come out book on Secure coding with php.


-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1 - not licensed for commercial use: www.pgp.com

iQA/AwUBQlqrUSZV5e8av/DUEQJMtQCfZWYAAYfGX5zfmCWHxMGZffi87tUAnRGj
hAJ8nVzhK+VIlL4iPxDJRh02
=3Dn3TC
-----END PGP SIGNATURE-----

</PRE></FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Diabolic Crab<BR>Web Security,&nbsp; =
Research &=20
Development<BR>dP Security<BR>email: <A=20
href=3D"mailto:dcrab@digitalparadox.org">dcrab@digitalparadox.org</A><BR>=
website:www.digitalparadox.org=20
</FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>This message is confidential. It may =
also contain=20
information that is <BR>privileged or otherwise legally exempt from =
disclosure.=20
<BR>If you have received it by mistake please let us know by e-mail=20
<BR>immediately and delete it from your system; should also not copy =
<BR>the=20
message nor disclose its contents to anyone. Many thanks.</FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV></BODY></HTML>

------=_NextPart_000_0005_01C53EE6.43632B60--
Login or Register to add favorites

File Archive:

November 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    30 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    44 Files
  • 6
    Nov 6th
    18 Files
  • 7
    Nov 7th
    9 Files
  • 8
    Nov 8th
    8 Files
  • 9
    Nov 9th
    3 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    0 Files
  • 12
    Nov 12th
    0 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    0 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close